I've messed up trying to install wireshark on OSX. Here's what I did.

  • I downloaded and installed wireshark from their website. It didn't work due to missing X11.
  • I started to troubleshoot this, but found there was a homebrew recipe (surprise!)
  • I uninstalled wireshark according to their detailed delete-this-delete-that instructions included in the dmg.
  • I installed the homebrew recipe. When I ran homebrew it complained of WIRESHARK_APP_DIR not being set. A quick google showed that this was a conflict between versions of /usr/local/bin/wireshark
  • I (stupidly?) did a rm /usr/local/bin/wireshark and attempted a re-install with brew.
  • I brew reinstalled, relinked, forced, updated and all manner of commands trying to get a wireshark command back, but without any luck.

With every wireshark installation completely uninstalled, I am still unable to get a successful install of wireshark via brew, due to this missing binary. What should I try next?


My error was assuming there was anything wrong with my wireshark install. The default brew recipe for wireshark does not have the wireshark executable.

The following process enabled wireshark for me:

  1. Manually install the dependency xquartz
  2. Execute brew install -vd --build-from-source --with-gtk+3 --with-libpcap wireshark

Then to run it, more tomfoolery:

  1. Start xquartz.app
    1. open a terminal (command N)
    2. enter host + to allow connections to xquartz
    3. enter echo $DISPLAY to get the display ID
  2. In iTerm, load d-bus. launchctl load /usr/local/Cellar/d-bus/1.8.12/org.freedesktop.dbus-session.plist (replace with appropriate version).
  3. set the DISPLAY with the value from step 1.3 above. Assuming it was :0 then export DISPLAY=:0
  4. finally, run this sucker: wireshark

After all this the app will be running, but you won't be able to capture. That's my next challenge...

  • 1
    Not sure why exactly you need wireshark on MacOS, however tcpdump is readily available on MacOS and still works fine for 99% of most tasks I've seen people perform. If you need a libpcap-interpreting GUI on MacOS, then you might want to look at [Cocoa Packet Analyzer] (tastycocoabytes.com/cpa/index.php). And if you really need some fancy networking analysis features, get a copy of live KALI distribution and fire it up each time you need to perform some advanced network analysis. You'll save yourself a tremendous amount of time. – Moreaki Feb 27 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.